@juliangruber/harness 1.0.0 → 1.0.1

package/dist/debug.js

@@ -1,6 +1,6 @@
 import { stderr } from 'node:process';
 import { styleText } from 'node:util';
-import { renderMarkdown } from './markdown.js';
+import { renderMarkdown, stripControl } from './markdown.js';
 const style = (format, text) => styleText(format, text, { stream: stderr });
 const indent = (text, spaces) => text.split('\n').map(line => line && ' '.repeat(spaces) + line).join('\n');
 // Printed between the debug log and the rendered answer
@@ -17,7 +17,7 @@ function formatArguments(args) {
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
         return indent(JSON.stringify(parsed, null, 2), 2);
     return Object.entries(parsed).map(([key, value]) => {
-        const text = typeof value === 'string' ? value : JSON.stringify(value);
+        const text = stripControl(typeof value === 'string' ? value : JSON.stringify(value));
         return text.includes('\n')
             ? `  ${style('dim', `${key}:`)}\n${indent(text, 4)}`
             : `  ${style('dim', `${key}:`)} ${text}`;
@@ -26,11 +26,12 @@ function formatArguments(args) {
 function formatResult(content) {
     if (/^\s*[[{]/.test(content)) {
         try {
-            return JSON.stringify(JSON.parse(content), null, 2);
+            return stripControl(JSON.stringify(JSON.parse(content), null, 2));
         }
         catch { }
     }
-    return content;
+    // Tool results (web pages, MCP output) are untrusted, strip terminal escapes
+    return stripControl(content);
 }
 // Wraps a client to log everything exchanged with the model, including
 // implicit context like the system prompt, tool definitions and tool results

package/dist/instructions.js

@@ -1,5 +1,6 @@
 import { readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { stripControl } from './markdown.js';
 // In order of preference, matched case insensitively
 const FILENAMES = ['agents.md', 'agent.md', 'claude.md'];
 const PREVIEW_LINES = 10;
@@ -22,7 +23,9 @@ export async function resolveInstructions(cwd, { trust, ask, warn }) {
         warn(`Ignoring ${instructions.path}: can't ask whether to trust it. Pass --trust to use it.`);
         return;
     }
-    const lines = instructions.content.split('\n');
+    // Strip control characters, so hidden or line-rewriting text can't disguise
+    // what the file actually says in the preview the user approves
+    const lines = stripControl(instructions.content).split('\n');
     const preview = lines.slice(0, PREVIEW_LINES).map(line => `  ${line}`).join('\n');
     const more = lines.length > PREVIEW_LINES ? `\n  [${lines.length - PREVIEW_LINES} more lines]` : '';
     const answer = await ask(`Found ${instructions.path} for review:\n${preview}${more}\nUse these instructions? [y/N] `);

package/dist/markdown.js

@@ -1,5 +1,10 @@
 import { lexer } from 'marked';
 import { stripVTControlCharacters, styleText } from 'node:util';
+// Removes terminal control characters (ANSI escapes, carriage returns) but
+// keeps newlines and tabs, so model or tool text can't rewrite lines, hide
+// itself, or change the terminal title when printed. Not printable: 0x00-0x08,
+// 0x0b-0x1f, 0x7f-0x9f. Kept: tab (0x09), newline (0x0a).
+export const stripControl = (text) => text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, '');
 // Renders markdown for the terminal: marked parses, util.styleText styles
 export function renderMarkdown(markdown, { color, stream, highlight } = {}) {
     const style = (format, text) => color === false ? text : styleText(format, text, { validateStream: color === undefined, stream });
@@ -61,7 +66,7 @@ export function renderMarkdown(markdown, { color, stream, highlight } = {}) {
         const divider = style('dim', widths.map(w => '─'.repeat(w)).join('─┼─'));
         return [line(header), divider, ...rows.map(line)].join('\n');
     };
-    return block(lexer(markdown));
+    return block(lexer(stripControl(markdown)));
 }
 const width = (text = '') => stripVTControlCharacters(text).length;
 const indent = (text, n) => text.split('\n').map(line => line && ' '.repeat(n) + line).join('\n');

package/dist/tools.js

@@ -3,6 +3,8 @@ import { glob as fsGlob, mkdir, readFile, realpath, stat, writeFile } from 'node
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 const MAX_OUTPUT = 30_000;
 const MAX_RESULTS = 200;
+// Longest line grep runs a pattern against, to bound regex backtracking
+const MAX_LINE = 1000;
 const truncate = (text) => text.length > MAX_OUTPUT
     ? `${text.slice(0, MAX_OUTPUT)}\n[truncated ${text.length - MAX_OUTPUT} chars]`
     : text;
@@ -41,6 +43,17 @@ async function checkPath(path) {
         throw new Error(`${path} is outside the working directory ${fileRoot}, file tools can only access files inside it`);
     }
 }
+// Writing into .git would let a planted hook run on the next git command,
+// outside the harness. Refused even inside the working directory.
+async function checkWritePath(path) {
+    await checkPath(path);
+    if (fileRoot === undefined)
+        return;
+    const real = await realPathOf(resolve(path));
+    if (real.split(sep).includes('.git')) {
+        throw new Error(`${path} is inside a .git directory, which file tools don't write to`);
+    }
+}
 export const read = {
     name: 'read',
     description: 'Read a text file. For large files, use offset and limit to read a range of lines.',
@@ -72,7 +85,7 @@ export const write = {
         required: ['path', 'content']
     },
     async run({ path, content }) {
-        await checkPath(path);
+        await checkWritePath(path);
         await mkdir(dirname(path), { recursive: true });
         await writeFile(path, content);
         return `Wrote ${content.length} chars to ${path}`;
@@ -94,7 +107,7 @@ export const edit = {
     async run({ path, old_string: oldString, new_string: newString, replace_all: replaceAll = false }) {
         if (!oldString)
             throw new Error('old_string must not be empty');
-        await checkPath(path);
+        await checkWritePath(path);
         const parts = (await readFile(path, 'utf8')).split(oldString);
         const count = parts.length - 1;
         if (count === 0)
@@ -182,6 +195,9 @@ export const grep = {
     async run({ pattern, path = '.', include = '**/*' }) {
         const regex = new RegExp(pattern);
         await checkPath(path);
+        // Cap the input each match sees, so a catastrophic-backtracking pattern
+        // can't hang on a very long line (a minified file, say)
+        const forMatch = (line) => line.length > MAX_LINE ? line.slice(0, MAX_LINE) : line;
         const files = (await stat(path)).isFile()
             ? [path]
             : (await walk(include, path)).map(file => join(path, file));
@@ -199,7 +215,7 @@ export const grep = {
             if (content.includes('\0'))
                 continue;
             content.split('\n').forEach((line, i) => {
-                if (regex.test(line))
+                if (regex.test(forMatch(line)))
                     matches.push(`${file}:${i + 1}: ${line.slice(0, 500)}`);
             });
             if (matches.length > MAX_RESULTS)
@@ -208,6 +224,9 @@ export const grep = {
         return matches.length ? limitResults(matches) : 'No matches found';
     }
 };
+// Keeps secrets, like the LLM API key, out of commands the model runs
+const SECRET_ENV = /KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH/i;
+const scrubbedEnv = () => Object.fromEntries(Object.entries(process.env).filter(([name]) => !SECRET_ENV.test(name)));
 export const bash = {
     name: 'bash',
     description: 'Run a bash command in the working directory. Returns stdout and stderr. Prefer the dedicated tools when one fits.',
@@ -218,7 +237,7 @@ export const bash = {
     },
     run({ command }) {
         return new Promise(resolve => {
-            execFile('bash', ['-c', command], { timeout: 120_000, maxBuffer: 10 * 1024 * 1024 }, (err, stdout, stderr) => {
+            execFile('bash', ['-c', command], { timeout: 120_000, maxBuffer: 10 * 1024 * 1024, env: scrubbedEnv() }, (err, stdout, stderr) => {
                 let output = stdout + stderr;
                 if (err)
                     output += `\n[exit ${err.code ?? err.signal}]`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juliangruber/harness",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "General purpose agent harness with fair research, for LLMs behind an OpenAI compatible API",
   "repository": {
     "type": "git",